Forensic Discoveries Newsletter - A Shift in eDiscovery

When I began speaking and writing on eDiscovery, I often stated that computers and e-mail were the primary forms of communications in our society. Now I am beginning to question the accuracy of that statement, because mobile phones and SMS text messages are a close rival.

The mobile technologies now available are replacing many computers. In fact, 81% of business executives are connected to work through mobile devices. In addition, there are 3.5 million SMS text messages sent every day in America alone. But while mobile devices potentially provide a wealth of information for your case, they can also provide a new set of challenges.

The information available on mobile devices (cell phones and smartphones) varies greatly depending on the sophistication of the phone. Today's basic mobile phones usually contain call histories, SMS text messages, address books, pictures, and videos. But more advanced mobile devices such as Blackberries, iPhones, and the new Android phones can rival computers with the amount of potentially valuable information available.

Advanced mobile devices, in addition to basic information, may contain call durations, e-mail, calendars, memos, word documents, spreadsheets, presentations, PDFs, and Internet usage histories. Plus, with the ability to install additional applications, these advanced devices may also provide GPS location histories and a wealth of additional information depending on the applications installed. One artifact of valuable information available from iPhones can be found within the metadata of the pictures taken: the exact latitude and longitude of the location where the picture was taken.

So there's a potential goldmine in a technology that 91% of our population uses -- but there are also serious technical challenges in mining that gold. As the technology of mobile devices has evolved to an impressive level of sophistication, one important technological pillar has been overlooked: standardization.

With computers, various technological standards apply to hardware and software, and digital forensics depends on those standards for consistency. Mobile devices are more like the Wild West: each provider, and each phone from each provider, can vary drastically. This lack of standardization can make it difficult to obtain needed information. For example, information from password protected Blackberries cannot be obtained unless the password is reset by the business entity that issued the phone to the employee.

Another drastic difference between mobile phones and computers is deleted information. In speaking engagements, I often joke that "the delete key just entertains you" when referencing computers. However with mobile phones, the delete option is serious business. For technical architecture reasons that are beyond the scope of this article, deleted information is difficult to obtain from mobile phones. (The one exception is the iPhone, which is essentially a scaled down version of an Apple computer, but even then recovering deleted information is no picnic.)

To prevent high expectations of recovering deleted information from mobile devices, I emphasize as clearly as possible that recovering usable deleted information from mobile phones is unlikely. Digital investigators are successful in recovering deleted information from phones on occasion, but that result is not typical.

You could try to obtain information that has been deleted from the mobile phone by subpoenaing the wireless carrier. But this will also likely be unsuccessful at least with regard to SMS text messages, an information set that is often the most prized. For various reasons, wireless providers have implemented short retention policies for this information. My experience, and that of my colleagues, indicates that SMS text messages will not be available long enough to obtain the information via civil subpoena. With some phones, text messages are deleted almost immediately upon delivery; with others, the messages last up to three days after delivery.

The good news is, the sending and receiving numbers of the SMS text message, along with call histories, will be retained for billing purposes for up to six months in some instances. There are a few other options depending on the model and usage of the phone, but the simplest is to realize that the message at one time existed on two phones: the sending phone and the receiving phone. Where possible, try to obtain the information from the other location.

Another option arises because more advanced mobile devices often "sync" with a computer. In such cases, it is possible that the computer with which the mobile device was synced will have historical information. A final option is for advanced mobile devices that are issued by the owning company, mainly Blackberries. Many companies maintain a server that communicates to and from the Blackberry devices called a BES server. In some companies, these servers have backups that may contain the information you're interested in.

Mobile devices are the technology of choice for business communications and have likely surpassed computers for personal communications. The statistic that 91% of our population uses them may be hard to believe, but think about what you can observe in our culture on your own: phones in use in offices, restaurants, movie theatres, and by the driver beside you on the interstate. Moreover, actual phone calls are less than half of the usage of many mobile phones. For "crackberry" users like me, information resides on my phone that I have forgotten is there, and it is unavailable anywhere else.

This source of information should not be ignored in electronic discovery and digital forensics. While the likelihood of being able to recover deleted information from most mobile devices is low, my best advice is to preserve the devices and collect information as soon as possible to prevent destruction or loss.

Avoiding ethical pitfalls with electronic documents: Part 1 - Metadata